Use gateway identifier for macOS CLI signing

Author: Pyiner

AGENTS.md

@@ -108,7 +108,7 @@ needs installed-app validation.
 - On macOS, do not treat a matching hash as sufficient after copying a locally
   built `garyx` binary into a launchd-managed path such as
   `/opt/homebrew/bin/garyx`. Clear removable target-file xattrs, ad-hoc re-sign
-  the installed file with the stable identifier `com.garyx.cli` (or use
+  the installed file with the stable identifier `com.garyx.gateway` (or use
   `bash scripts/codesign-macos-cli.sh <path-to-garyx>`), and verify it executes
   before restarting, otherwise launchd/AMFI may kill it with
   `OS_REASON_CODESIGNING`. `com.apple.provenance` can be inherited or protected

CLAUDE.md

@@ -108,7 +108,7 @@ needs installed-app validation.
 - On macOS, do not treat a matching hash as sufficient after copying a locally
   built `garyx` binary into a launchd-managed path such as
   `/opt/homebrew/bin/garyx`. Clear removable target-file xattrs, ad-hoc re-sign
-  the installed file with the stable identifier `com.garyx.cli` (or use
+  the installed file with the stable identifier `com.garyx.gateway` (or use
   `bash scripts/codesign-macos-cli.sh <path-to-garyx>`), and verify it executes
   before restarting, otherwise launchd/AMFI may kill it with
   `OS_REASON_CODESIGNING`. `com.apple.provenance` can be inherited or protected

garyx/src/commands.rs

@@ -98,7 +98,7 @@ const CLAUDE_OAUTH_ENV: &str = "CLAUDE_CODE_OAUTH_TOKEN";
 const CODEX_API_KEY_ENV: &str = "OPENAI_API_KEY";
 const GITHUB_RELEASE_REPO: &str = "Pyiner/garyx";
 #[cfg(any(target_os = "macos", test))]
-const MACOS_CLI_CODESIGN_IDENTIFIER: &str = "com.garyx.cli";
+const MACOS_CLI_CODESIGN_IDENTIFIER: &str = "com.garyx.gateway";
 const DEFAULT_CHANNEL_AGENT_ID: &str = "claude";
 
 #[derive(Debug, Deserialize)]

garyx/src/commands/tests.rs

@@ -1167,7 +1167,7 @@ fn macos_cli_codesign_args_use_stable_identifier() {
             "--sign",
             "-",
             "--identifier",
-            "com.garyx.cli",
+            "com.garyx.gateway",
             "/tmp/garyx"
         ]
     );

scripts/codesign-macos-cli.sh

@@ -14,7 +14,7 @@ if [[ $# -ne 1 ]]; then
 fi
 
 binary="$1"
-identifier="com.garyx.cli"
+identifier="com.garyx.gateway"
 
 if [[ ! -f "$binary" ]]; then
   echo "Error: binary does not exist: $binary" >&2